SAA-C03 Design Secure Architectures Practice Question
A company wants to give a third-party auditor read-only access to a specific Amazon S3 bucket for a limited period. The auditor has an AWS account and will use their own IAM credentials. The company must not share long-term credentials and wants to revoke access automatically when the audit ends. What is the most secure way to grant this access?
⚠ Common exam trap
The trap here is thinking that presigned URLs provide the same level of controlled, revocable, bucket-wide access as a cross-account IAM role, when they are object-specific and harder to revoke centrally.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role in the company account with a trust policy that allows the auditor's AWS account to assume it, and attach a read-only S3 policy with a condition limiting access to the audit period.
Cross-account IAM role assumption is the standard secure pattern for granting temporary access to external parties. The auditor assumes a role using their own identity, receives temporary credentials, and the company retains full control over permissions and revocation. This avoids sharing long-term credentials and supports time-bound access conditions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an IAM role in the company account with a trust policy that allows the auditor's AWS account to assume it, and attach a read-only S3 policy with a condition limiting access to the audit period.
Why this is correct
Cross-account IAM role assumption lets the auditor use their own credentials to obtain temporary session tokens, so no long-term secrets are shared. The trust policy and permissions can include time-based conditions, and removing the trust or the role revokes access immediately when the audit ends.
- ✗
Enable S3 Block Public Access and provide the auditor with the bucket's ARN so they can configure their own access.
Why it's wrong here
Block Public Access prevents public exposure but does not grant any cross-account permissions. Providing only the bucket ARN gives the auditor no ability to read objects, and there is no mechanism for the company to control or revoke access, so this does not meet the requirement.
- ✗
Create an IAM user in the company account with read-only S3 permissions and share the access keys with the auditor.
Why it's wrong here
Sharing long-term access keys violates the requirement to avoid long-term credentials and creates a significant security risk if the keys are leaked. Revoking access requires deleting the user or rotating keys, and there is no automatic expiration, so this approach is not the most secure.
- ✗
Generate a presigned URL for each object in the bucket and send the URLs to the auditor.
Why it's wrong here
Presigned URLs are useful for temporary access to specific objects, but they must be generated per object and can be cumbersome for an auditor who needs to list and browse the bucket. They also do not provide a clean, centralized revocation mechanism across all objects.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 935 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.